I have a small, personal Firebase webapp that uses Firebase Database. I want to secure (lock down) this app to any user from a single, specific domain. I want to authenticate with Google. I'm not clear how to configure the rules to say "only users from a single, specific domain (say @foobar.com
) can read and write to this database".
(Part of the issue that I see: it's hard to bootstrap a Database with enough info to make this use case work. I need to know the user's email at the time of authentication, but auth
object doesn't contain email. It seems to be a chicken-egg problem, because I need to write Firebase rules that refer to data in the Database, but that data doesn't exist yet because my user can't write to the database.)
If auth
had email, then I could write the rules easily.
Thanks in advance!
WARNING: do not trust this answer. Just here for discussion.
tldr: I don't think it's possible, without running your own server.
Here's my attempt thus far:
I believe the above says "only allow people to create a new user if they are authenticated by Google, are trying to write into the database node for themselve (
$user_id === auth.uid
) and their email ends in foobar.com".However, a problem was pointed out: any web client can easily change their email (using the dev console) before the message is sent to Firebase. So we can't trust the user entry's data when stored into Firebase.
I think the only thing we can actually trust is the
auth
object in the rules. Thatauth
object is populated by Firebase's backend. And, unfortunately, theauth
object does not include the email address.For the record, I am inserting my user this way:
As you might be able to imagine, a determined user could overwrite the value of
email
here (by using the DevTools, for examples).Code which is working for me.
Here is code working fine with my database , I have set rule that only my company emails can read and write data of my firebase database .
If you're using the new Firebase this is now possible, since the
email
is available in the security rules.In the security rules you can access both the email address and whether it is verified, which makes some great use-cases possible. With these rules for example only an authenticated, verified gmail user can write their profile:
You can enter these rules in the Firebase Database console of your project.